Vulnerability in libblockdev Affects ntfslabel and fatlabel Utilities
CVE-2026-111581

3.3LOW

Key Information:

Vendor

Red Hat
Status
Red Hat Enterprise Linux 10
Red Hat Enterprise Linux 7
Red Hat Enterprise Linux 8
Red Hat Enterprise Linux 9
Vendor
CVE Published:
16 October 2026

What is CVE-2026-111581?

A security flaw in the libblockdev library allows unprivileged local users to exploit the bd_fs_ntfs_set_label() and bd_fs_vfat_set_label() functions. By supplying label values that start with a dash, attackers can cause these values to be interpreted as command-line flags by the associated ntfslabel and fatlabel utilities. This could lead to bypassing essential safety checks or triggering unintended operations, all without the need for administrator authentication via the udisks2 Filesystem.SetLabel() D-Bus method.

References

https://access.redhat.com/security/cve/CVE-2026-111581
vdb-entryx_refsource_REDHAT
https://bugzilla.redhat.com/show_bug.cgi?id=2554104
issue-trackingx_refsource_REDHAT

CVSS V3.1

Score:
3.3
Severity:
LOW
Confidentiality:
None
Integrity:
Low
Availability:
None
Attack Vector:
Local
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Red Hat would like to thank Yashashree Gund for reporting this issue.
.